CVE-2023-5950

CVSS 3.1 Score 6.1 of 10 (medium)

Details

Published Nov 6, 2023
Updated: Nov 14, 2023
CWE ID 79

Summary

CVE-2023-5950 is a reflected cross-site scripting (XSS) vulnerability affecting Rapid7 Velociraptor versions prior to 0.7.0-4. An attacker can exploit this issue by injecting malicious JavaScript into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability has been addressed in version 0.7.0-04 and patches are available for download. Additionally, patches are available for version 0.6.9 (0.6.9-1). Users are strongly encouraged to apply the patches to mitigate the risk of this vulnerability.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Rapid7 Velociraptor

Affected Vendors

  • Rapid7

Advisories, Assessments, and Mitigations